The File Renaming on Upload plugin for WordPress is vulnerable to a type of attack called Stored Cross-Site Scripting. This type of attack can allow someone with administrator-level permissions to insert malicious web scripts in pages. When a user accesses the page, the malicious script will execute. This type of vulnerability only affects multi-site installations and installations where certain security measures have been disabled. The vulnerable versions of the plugin are up to and including 2.5.1, and the vulnerability is caused by insufficient input sanitization and output escaping.